Practice 01

Architecture

Microsoft 365, Azure, and Teams Phone designed the way enterprises run them. Identity, devices, data, voice, and security built once, documented, and owned by you.

1.1 Microsoft 365 and Azure1.2 Security1.3 Governance1.4 Teams Phone1.5 Transitions

1.1

Microsoft 365 and Azure architecture

The tenant, identity, endpoint, and Azure architecture enterprises run on, built right the first time instead of patched together over five years. Every decision documented, every policy justified, so the next person who touches it understands why it's built the way it is.

What we deliver

  • Entra ID design: Conditional Access, just-in-time admin, no standing Global Admin
  • Intune and Autopilot from zero-touch provisioning to compliance gating
  • Licensing standardized by role: Business Premium, E3, F3, F1, and what each actually needs
  • Apple Business Manager and iOS MDM, with BYOD on app protection instead of full enrollment
  • Purview retention and DLP designed before the data sprawls, not after
  • Teams Voice and the collaboration stack tied to the same identity model
  • Azure landing zones: subscriptions, policy, networking, and cost guardrails on the same identity model

Typical situations

  • A tenant nobody designed, grown one exception at a time.
  • A company standing up Microsoft 365 properly for the first time.
  • An acquisition that needs two tenants to become one.
Talk to us about architecture

How the layers fit together

1.2

Security and hardening

Defender, WDAC, attack surface reduction, and the configuration that turns a real audit or pen test into a formality instead of a scramble. Findings get remediated once, properly, not patched over until the next assessment surfaces the same gap.

What we deliver

  • Defender for Endpoint P2 in block mode: attack surface reduction, WDAC, network protection
  • Defender for Office 365: admin-only quarantine, Safe Attachments, impersonation controls
  • Conditional Access and device compliance that actually gate access
  • Privileged access: just-in-time roles, break-glass accounts tested, admin workstations where warranted
  • Pen test and red team remediation in production, with evidence, without breaking the business
  • Insurance and customer security questionnaires answered from configuration, not from memory

Typical situations

  • A pen test came back with findings you've seen before.
  • The insurance renewal wants MFA, EDR, and backups proven, not promised.
  • A phishing incident got further than it should have.
Talk to us about hardening

1.3

Process and governance

Documentation, change control, and operational standards that mean your systems outlast any one person. The goal isn't dependency on Corbel. It's a foundation your team can own and run.

What we deliver

  • A written standard for every tenant setting, with the reason behind it
  • Change control sized for a small team, not a bureaucracy
  • A knowledge base your team actually uses
  • Help desk with categories, SLAs, and reporting from day one
  • Joiner, mover, leaver process tied to HR and reconciled against the census
  • Quarterly review of what changed, what drifted, and what to fix

Typical situations

  • Your last admin left and nobody knows why anything is set the way it is.
  • The board wants IT to be auditable.
  • Onboarding takes a week and offboarding takes a month.
Talk to us about governance

1.4

Teams Phone

Business phones on the platform your people already use, designed from the dial plan up. Numbers, call flows, emergency calling, and the devices on desks, all on the same identity model as the rest of the tenant.

What we deliver

  • Calling Plans, Operator Connect, or Direct Routing, chosen on cost and the carriers you already have, not on habit
  • Number porting from the incumbent carrier with no downtime on main lines
  • Auto attendants, call queues, and shared lines designed from how your business actually answers the phone
  • Dynamic emergency calling that reports the right location for office, hybrid, and remote staff
  • Desk phones and headsets specified, enrolled in Intune, and held to the same standard as laptops
  • Policies by role: voicemail, call recording, international dialing, and compliance holds

Typical situations

  • The PBX contract ends next year and the vendor stopped answering.
  • Everyone is already in Teams but the phones are still on the wall.
  • Three acquisitions, three phone systems, one main number.
Talk to us about Teams Phone

1.5

Transitions and integrations

Acquisitions, carve-outs, and MSP exits. The work between signing and stable, run by people who have done the cutover and know where it breaks.

What we deliver

  • Tenant-to-tenant migration and identity consolidation for acquisitions
  • Carve-outs: a clean tenant stood up out of a parent company's environment
  • Cutover off an incumbent MSP: identities removed, agents replaced, help desk live before the old contract ends
  • Mobile migration off legacy or carrier MDM into Intune and Apple Business Manager
  • A written handoff so your team runs it without us in the room

Typical situations

  • The deal closes in 90 days and IT hasn't been scoped.
  • The MSP contract ends next quarter.
  • Two companies, two tenants, one board.
Talk to us about a transition

Ready when you are.

One call to find out if it's a fit. Both ways.

Book a consultation